---
id: "CVE-2026-91660"
kind: "vulnerability"
aliases: ["CVE-2026-91660"]
title: "Oracle Essbase: low-privilege HTTP request can partly deny service"
severity: "medium"
cvss: 4.3
epss: 0.00291
exploited: false
status: "open"
category: "vendor"
products: [{"name": "oracle essbase", "fixed": [], "affected": "= 21.8.3.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-essbase", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:21:06+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:37:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91660", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91660", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Essbase: low-privilege HTTP request can partly deny service

A low-privileged user with network access over HTTP can trigger a partial denial of service in Oracle Essbase, per the CVSS 3.1 vector. The sources describe only an availability impact, with no code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oracle essbase affected = 21.8.3.0.0 fixed ?

## How to check

- Check the installed Essbase version against the affected release `21.8.3.0.0`
- Confirm the Oracle Essbase Security component advisory listing for the patched build

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91660
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91660

## From the sources

Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_